
<!DOCTYPE html>
<html lang="" class="loading">
<head>
    <meta charset="UTF-8" />
    <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" />
    <meta name="viewport" content="width=device-width, minimum-scale=1.0, maximum-scale=1.0, user-scalable=no">
    <title>V&amp;N2020公开赛 - L3SLIE</title>
    <meta name="apple-mobile-web-app-capable" content="yes" />
    <meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
    <meta name="google" content="notranslate" />
    <meta name="keywords" content="L3SLIE,"> 
    <meta name="description" content="Welcome &amp; suit yourself,RE0x01 strangeCpp题目是个cpp程序，打开后可以运行，读了一遍我的环境变量就没了。。。
查壳，没有，拖入ida，进入String窗口，跟踪flag进入函数；
.rdata:00000,"> 
    <meta name="author" content="L3SLIE"> 
    <link rel="alternative" href="atom.xml" title="L3SLIE" type="application/atom+xml"> 
    <link rel="icon" href="/img/favicon.png"> 
    <link href="https://fonts.loli.net/css?family=Roboto+Mono|Rubik&display=swap" rel="stylesheet">
    
<link rel="stylesheet" href="//at.alicdn.com/t/font_1429596_nzgqgvnmkjb.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/animate.css/3.7.2/animate.min.css">

    
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/social-share.js/1.0.16/css/share.min.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/codemirror/5.48.4/codemirror.min.css">

    
<link rel="stylesheet" href="//cdn.bootcss.com/codemirror/5.48.4/theme/dracula.css">

    
<link rel="stylesheet" href="/css/obsidian.css">

    
<link rel="stylesheet" href="/css/ball-atom.min.css">

<meta name="generator" content="Hexo 4.2.0"></head>


<body class="loading">
    <div class="loader">
        <div class="la-ball-atom la-2x">
            <div></div>
            <div></div>
            <div></div>
            <div></div>
        </div>
    </div>
    <span id="config-title" style="display:none">L3SLIE</span>
    <div id="loader"></div>
    <div id="single">
    <div class="scrollbar gradient-bg-rev"></div>
<div id="top" style="display: block;">
    <div class="bar" style="width: 0;"></div>
    <div class="navigation animated fadeIn fast delay-1s">
        <img id="home-icon" class="icon-home" src="/img/favicon.png" alt="" data-url="http://l3slie.gitee.io">
        <div id="play-icon" title="Play/Pause" class="iconfont icon-play"></div>
        <h3 class="subtitle">V&N2020公开赛</h3>
        <div class="social">
            <!--        <div class="like-icon">-->
            <!--            <a href="javascript:;" class="likeThis active"><span class="icon-like"></span><span class="count">76</span></a>-->
            <!--        </div>-->
            <div>
                <div class="share">
                    
                        <a href="javascript:;" class="iconfont icon-share1"></a>
                        <div class="share-component-cc" data-disabled="facebook,douban,linkedin,diandian,tencent,google"></div>
                    
                </div>
            </div>
        </div>
    </div>
</div>

    <div class="section">
        <div class=article-header-wrapper>
    <div class="article-header">
        <div class="article-cover animated fadeIn" style="
            animation-delay: 600ms;
            animation-duration: 1.2s;
            background-image: 
                radial-gradient(ellipse closest-side, rgba(0, 0, 0, 0.65), #100e17),
                url(/img/cover1.jpg) ">
        </div>
        <div class="else">
            <p class="animated fadeInDown">
                
                <a href="/categories/XJUSEC"><b>「
                    </b>XJUSEC<b> 」</b></a>
                
                February 29, 2020
            </p>
            <h3 class="post-title animated fadeInDown"><a href="/2020/02/29/V-N2020%E5%85%AC%E5%BC%80%E8%B5%9B%E9%83%A8%E5%88%86re/" title="V&amp;N2020公开赛" class="">V&amp;N2020公开赛</a>
            </h3>
            
            <p class="post-count animated fadeInDown">
                
                <span>
                    <b class="iconfont icon-text2"></b> <i>Words count</i>
                    7.4k
                </span>
                
                
                <span>
                    <b class="iconfont icon-timer__s"></b> <i>Reading time</i>
                    7 mins.
                </span>
                
                
                <span id="/2020/02/29/V-N2020公开赛部分re/" class="leancloud_visitors" data-flag-title="V&N2020公开赛">
                    <b class="iconfont icon-read"></b> <i>Read count</i>
                    <span class="leancloud-visitors-count">100000</span>
                </span>
                
                
            </p>
            
            
            <ul class="animated fadeInDown post-tags-list" itemprop="keywords"><li class="animated fadeInDown post-tags-list-item"><a class="animated fadeInDown post-tags-list-link" href="/tags/CTF/" rel="tag">CTF</a></li><li class="animated fadeInDown post-tags-list-item"><a class="animated fadeInDown post-tags-list-link" href="/tags/WP/" rel="tag">WP</a></li></ul>
            
        </div>
    </div>
</div>

<div class="screen-gradient-after">
    <div class="screen-gradient-content">
        <div class="screen-gradient-content-inside">
            <div class="bold-underline-links screen-gradient-sponsor">
                <p>
                    <span class="animated fadeIn delay-1s"></span>
                </p>
            </div>
        </div>
    </div>
</div>

<div class="article">
    <div class='main'>
        <div class="content markdown animated fadeIn">
            <h1 id="RE"><a href="#RE" class="headerlink" title="RE"></a>RE</h1><h2 id="0x01-strangeCpp"><a href="#0x01-strangeCpp" class="headerlink" title="0x01 strangeCpp"></a>0x01 strangeCpp</h2><p>题目是个cpp程序，打开后可以运行，读了一遍我的环境变量就没了。。。</p>
<p>查壳，没有，拖入ida，进入String窗口，跟踪flag进入函数；</p>
<pre><code class="txt">.rdata:000000014001DCC0    00000009    C    _ArgList
.rdata:000000014001DE00    00000008    C    sysInfo
.rdata:000000014001DE60    00000014    C    ok,I am checking...
.rdata:000000014001DF08    0000001D    C    flag{where_is_my_true_flag?}
.rdata:000000014001DFD0    0000001A    C    now system cpu num is %d\n
.rdata:000000014001E000    0000000F    C    Are you in VM?
.rdata:000000014001E028    0000000F    C    this is useful
.rdata:000000014001E084    00000006    C    pause
.rdata:000000014001E0D8    0000001C    C    Stack around the variable &#39;
.rdata:000000014001E0F8    00000011    C    &#39; was corrupted.</code></pre>
<pre><code class="cpp">__int64 __fastcall sub_140013AA0(__int64 a1, __int64 a2, __int64 *a3)
{
  char *v3; // rdi
  signed __int64 i; // rcx
  __int64 v5; // rax
  __int64 v6; // rax
  __int64 v7; // rax
  __int64 v8; // rax
  char v10; // [rsp+0h] [rbp-20h]
  struct _SYSTEM_INFO SystemInfo; // [rsp+28h] [rbp+8h]
  __int64 *j; // [rsp+78h] [rbp+58h]
  __int64 v13; // [rsp+98h] [rbp+78h]
  __int64 *v14; // [rsp+1A0h] [rbp+180h]

  v14 = a3;
  v3 = &amp;v10;
  for ( i = 94i64; i; --i )
  {
    *(_DWORD *)v3 = -858993460;
    v3 += 4;
  }
  sub_1400110AA(&amp;unk_140027033);
  GetSystemInfo(&amp;SystemInfo);
  putchar(byte_140021004);
  putchar(byte_140021005);
  putchar(byte_140021006);
  putchar(byte_140021007);
  putchar(byte_140021019);
  putchar(byte_14002101A);
  putchar(byte_140021005);
  putchar(10);
  puts(&quot;Let me have a look at your computer...&quot;);
  for ( j = v14; *j; ++j )
  {
    v13 = *j;
    sub_140011226(&quot;%s\n&quot;, v13);
  }
  std::basic_ostream&lt;char,std::char_traits&lt;char&gt;&gt;::operator&lt;&lt;(std::cout, sub_140011127);
  dword_140021190 = SystemInfo.dwNumberOfProcessors;
  sub_140011226(&quot;now system cpu num is %d\n&quot;, SystemInfo.dwNumberOfProcessors);
  if ( dword_140021190 &lt; 8 )
  {
    puts(&quot;Are you in VM?&quot;);
    _exit(0);
  }
  if ( GetUserNameA(Str1, &amp;pcbBuffer) )
  {
    v5 = sub_140011172(std::cout, &quot;this is useful&quot;);
    std::basic_ostream&lt;char,std::char_traits&lt;char&gt;&gt;::operator&lt;&lt;(v5, sub_140011127);
  }
  v6 = std::basic_ostream&lt;char,std::char_traits&lt;char&gt;&gt;::operator&lt;&lt;(std::cout, sub_140011127);
  v7 = sub_140011172(v6, &quot;ok,I am checking...&quot;);
  std::basic_ostream&lt;char,std::char_traits&lt;char&gt;&gt;::operator&lt;&lt;(v7, sub_140011127);
  if ( !j_strcmp(Str1, &quot;cxx&quot;) )
  {
    v8 = sub_140011172(std::cout, &quot;flag{where_is_my_true_flag?}&quot;);
    std::basic_ostream&lt;char,std::char_traits&lt;char&gt;&gt;::operator&lt;&lt;(v8, sub_140011127);
    _exit(0);
  }
  system(&quot;pause&quot;);
  sub_1400113E3(&amp;v10, &amp;unk_14001DE50);
  return 0i64;
}</code></pre>
<p>后半段没用，执行了就是输出环境变量名字，主要在前面的<code>putchar</code>里，跟踪函数，进入<code>sub_140013580</code>。</p>
<pre><code class="cpp">__int64 sub_140013580()
{
  __int64 *v0; // rdi
  signed __int64 i; // rcx
  __int64 result; // rax
  __int64 v3; // [rsp+0h] [rbp-20h]
  int v4; // [rsp+24h] [rbp+4h]
  int j; // [rsp+44h] [rbp+24h]
  __int64 v6; // [rsp+128h] [rbp+108h]

  v0 = &amp;v3;
  for ( i = 82i64; i; --i )
  {
    *(_DWORD *)v0 = -858993460;
    v0 = (__int64 *)((char *)v0 + 4);
  }
  v6 = -2i64;
  sub_1400110AA(&amp;unk_140027033);
  result = sub_140011384((unsigned int)dword_140021190);
  v4 = result;
  if ( (_DWORD)result == 607052314 &amp;&amp; dword_140021190 &lt;= 14549743 )
  {
    for ( j = 0; j &lt; 17; ++j )
    {
      putchar((unsigned __int8)(dword_140021190 ^ byte_140021008[j]));//17个字符和dword_140021190进行异或
      result = (unsigned int)(j + 1);
    }
  }
  return result;
}</code></pre>
<pre><code class="cpp">//byte_140021008的内容
unsigned char ida_chars[] =
{
  0x26, 0x2C, 0x21, 0x27, 0x3B, 0x0D, 0x04, 0x75, 0x68, 0x34, 
  0x28, 0x25, 0x0E, 0x35, 0x2D, 0x69, 0x3D
};</code></pre>
<p>因为<code>dword_140021190</code>是个0，所以flag应该是要爆破。</p>
<pre><code class="python">import hashlib
result = 0
for v8 in range(14549743):
    v7 = (((v8 &lt;&lt; 8) ^ (v8 &gt;&gt; 12))*291)&amp;0xFFFFFFFF # 原文是unsigned int--0~0xFFFFFFFF,输出的值需要截断
    if (v7 == 607052314):
        result = v8
        break

a=[0x26,0x2c,0x21,0x27,0x3B,0x0D,0x4,0x75,0x68,0x34,0x28,0x25,0xe,0x35,0x2D,0x69,0x3D]
for i in range(0,128):
    flag=[]
    for j in a:
        flag.append(chr(i^j))
    flag = &quot;&quot;.join(flag)
    if &#39;{&#39;in flag:
        print(i,flag)
md = hashlib.md5()
md.update(str(result).encode(&#39;utf-8&#39;))
print (&quot;flag{&quot;+md.hexdigest()+&quot;}&quot;)
# flag{MD5(theNum)} 
# flag{e10adc3949ba59abbe56e057f20f883e}</code></pre>
<pre><code class="python">#运行效果
(14, &#39;(&quot;/)5\x03\n{f:&amp;+\x00;#g3&#39;)
(18, &quot;4&gt;35)\x1f\x16gz&amp;:7\x1c&#39;?{/&quot;)
(19, &quot;5?24(\x1e\x17f{&#39;;6\x1d&amp;&gt;z.&quot;)
(64, &#39;flag{MD5(theNum)}&#39;)   
(70, &#39;`jga}KB3.rncHsk/{&#39;)
(78, &quot;hboiuCJ;&amp;zfk@{c&#39;s&quot;)
(79, &quot;icnhtBK:&#39;{gjAzb&amp;r&quot;)
(83, &#39;u\x7frth^W&amp;;g{v]f~:n&#39;)
(86, &#39;pzwqm[R#&gt;b~sXc{?k&#39;)
(87, &#39;q{vplZS&quot;?c\x7frYbz&gt;j&#39;)
(90, &#39;|v{}aW^/2nr\x7fTow3g&#39;)
(92, &#39;zp}{gQX)4htyRiq5a&#39;)
(93, &#39;{q|zfPY(5iuxShp4`&#39;)
(94, &#39;xr\x7fyeSZ+6jv{Pks7c&#39;)
(117, &#39;SYTRNxq\x00\x1dA]P{@X\x1cH&#39;)
(118, &#39;PZWQM{r\x03\x1eB^SxC[\x1fK&#39;)
(127, &#39;YS^XDr{\n\x17KWZqJR\x16B&#39;)</code></pre>
<h2 id="0x02-CSRe"><a href="#0x02-CSRe" class="headerlink" title="0x02 CSRe"></a>0x02 CSRe</h2><p>打开程序发现是.NET，并且输出有乱码：</p>
<pre><code class="txt">未经处理的异常:  System.Exception: The assembly CS_exe.exe has been built with an evaluation version of Eazfuscator.NET, which has expired.
   在 .(Boolean )
   在 ?.(String[] )</code></pre>
<p>dnspy打开发现有混淆，ScanId查混淆也没查出来是啥。。</p>
<pre><code class="c#">// \u0002
// Token: 0x06000001 RID: 1 RVA: 0x00002050 File Offset: 0x00000250
public static string \u0002()
{
    return \u0008\u2000.\u0002(-102257640);
}
//混淆</code></pre>
<p>好在de4dot能解。</p>
<p>反混淆后</p>
<pre><code class="c#">// Class3
// Token: 0x0600000F RID: 15 RVA: 0x00002374 File Offset: 0x00000574
private static void Main(string[] args)
{
    if (!Class1.smethod_1())
    {
        return;
    }
    bool flag = true;
    Class3 @class = new Class3();
    string str = Console.ReadLine();
    if (Class3.smethod_0(&quot;3&quot; + str + &quot;9&quot;) != &quot;B498BFA2498E21325D1178417BEA459EB2CD28F8&quot;)
    {
        flag = false;
    }
    string text = Console.ReadLine();
    string string_ = Class3.smethod_0(&quot;re&quot; + text);
    string text2 = @class.method_0(string_, &quot;63143B6F8007B98C53CA2149822777B3566F9241&quot;);
    for (int i = 0; i &lt; text2.Length; i++)
    {
        if (text2[i] != &#39;0&#39;)
        {
            flag = false;
        }
    }
    if (flag)
    {
        Console.WriteLine(&quot;flag{&quot; + str + text + &quot;}&quot;);
    }
}
//逻辑很清晰，smethod_0是对字符串进行sha1加密后大写Hex输出，所以只需要将这两串进行sha1解密就可以了
//B498BFA2498E21325D1178417BEA459EB2CD28F8=314159
//63143B6F8007B98C53CA2149822777B3566F9241=return
//去掉3，9，re后组装为flag
//flag{1415turn}</code></pre>

            <!--[if lt IE 9]><script>document.createElement('audio');</script><![endif]-->
            <audio id="audio" loop="1" preload="auto" controls="controls"
                data-autoplay="false">
                <source type="audio/mpeg" src="">
            </audio>
            
            <ul id="audio-list" style="display:none">
                
                
                <li title='0' data-url='/statics/i saw you in a dream.mp3'></li>
                
                    
            </ul>
            
            
            
            <div id="vcomments"></div>
            
        </div>
        <div class="sidebar">
            <div class="box animated fadeInRight">
                <div class="subbox">
                    <img src="/img/avatar.jpg" height=300 width=300></img>
                    <p>L3SLIE</p>
                    <span>Life Long & Pwn</span>
                    <dl>
                        <dd><a href="https://github.com/13slie" target="_blank"><span
                                    class=" iconfont icon-github"></span></a></dd>
                        <dd><a href="" target="_blank"><span
                                    class=" iconfont icon-twitter"></span></a></dd>
                        <dd><a href="https://stackexchange.com/users/17805607/l3slie" target="_blank"><span
                                    class=" iconfont icon-stack-overflow"></span></a></dd>
                    </dl>
                </div>
                <ul>
                    <li><a href="/">46 <p>Articles</p></a></li>
                    <li><a href="/categories">13 <p>Categories</p></a></li>
                    <li><a href="/tags">20 <p>Tags</p></a></li>
                    <br><span><b><p>友链博客</p></b></span><br>
                    <span><u><p><a href="http://rdd.xjusec.club/" target="_blank">Rdd</a></p></u></span>
                    <span><u><p><a href="http://www.xjusec.club/" target="_blank">XJUSEC</a></p></u></span>
                    <span><u><p><a href="http://www.r1ght0us.xyz/" target="_blank">r1ght0us</a></p></u></span>
                </ul>
            </div>
            
            
            
            <div class="box sticky animated fadeInRight faster">
                <div id="toc" class="subbox">
                    <h4>Contents</h4>
                    <ol class="toc"><li class="toc-item toc-level-1"><a class="toc-link" href="#RE"><span class="toc-number">1.</span> <span class="toc-text">RE</span></a><ol class="toc-child"><li class="toc-item toc-level-2"><a class="toc-link" href="#0x01-strangeCpp"><span class="toc-number">1.1.</span> <span class="toc-text">0x01 strangeCpp</span></a></li><li class="toc-item toc-level-2"><a class="toc-link" href="#0x02-CSRe"><span class="toc-number">1.2.</span> <span class="toc-text">0x02 CSRe</span></a></li></ol></li></ol>
                </div>
            </div>
            
            
        </div>
    </div>
</div>

    </div>
</div>
    <div id="back-to-top" class="animated fadeIn faster">
        <div class="flow"></div>
        <span class="percentage animated fadeIn faster">0%</span>
        <span class="iconfont icon-top02 animated fadeIn faster"></span>
    </div>
</body>
<footer>
    <p class="copyright" id="copyright">
		<span id="timeDate">载入天数...</span><span id="times">载入时分秒...</span>
		<script>
		var now = new Date(); 
		function createtime() { 
			var grt= new Date("01/10/2020 00:00:00");//在此处修改你的建站时间
			now.setTime(now.getTime()+250); 
			days = (now - grt ) / 1000 / 60 / 60 / 24; dnum = Math.floor(days); 
			hours = (now - grt ) / 1000 / 60 / 60 - (24 * dnum); hnum = Math.floor(hours); 
			if(String(hnum).length ==1 ){hnum = "0" + hnum;} minutes = (now - grt ) / 1000 /60 - (24 * 60 * dnum) - (60 * hnum); 
			mnum = Math.floor(minutes); if(String(mnum).length ==1 ){mnum = "0" + mnum;} 
			seconds = (now - grt ) / 1000 - (24 * 60 * 60 * dnum) - (60 * 60 * hnum) - (60 * mnum); 
			snum = Math.round(seconds); if(String(snum).length ==1 ){snum = "0" + snum;} 
			document.getElementById("timeDate").innerHTML = "本站已安全运行 "+dnum+" 天 "; 
			document.getElementById("times").innerHTML = hnum + " 小时 " + mnum + " 分 " + snum + " 秒"; 
		} 
		setInterval("createtime()",250);
		</script>
        &copy; 2020
        <span class="gradient-text">
            L3SLIE
        </span>❤
        Powered by <a href="http://hexo.io/" title="Hexo" target="_blank" rel="noopener">Hexo</a>
        Theme
        <span class="gradient-text">
            <a href="https://github.com/TriDiamond/hexo-theme-obsidian" title="Obsidian" target="_blank" rel="noopener">Obsidian</a>
        </span>
        <small><a href="https://github.com/TriDiamond/hexo-theme-obsidian/blob/master/CHANGELOG.md" title="v1.4.3" target="_blank" rel="noopener">v1.4.3</a></small>
    </p>
</footer>

<script type="text/javascript" src="https://cdn.bootcss.com/mathjax/2.7.6/MathJax.js?config=TeX-AMS-MML_HTMLorMML">
</script>
<script>
  MathJax.Hub.Config({
    "HTML-CSS": {
      preferredFont: "TeX",
      availableFonts: ["STIX", "TeX"],
      linebreaks: {
        automatic: true
      },
      EqnChunk: (MathJax.Hub.Browser.isMobile ? 10 : 50)
    },
    tex2jax: {
      inlineMath: [
        ["$", "$"],
        ["\\(", "\\)"]
      ],
      processEscapes: true,
      ignoreClass: "tex2jax_ignore|dno",
      skipTags: ['script', 'noscript', 'style', 'textarea', 'pre', 'code']
    },
    TeX: {
      noUndefined: {
        attributes: {
          mathcolor: "red",
          mathbackground: "#FFEEEE",
          mathsize: "90%"
        }
      },
      Macros: {
        href: "{}"
      }
    },
    messageStyle: "none"
  });
</script>
<script>
  function initialMathJax() {
    MathJax.Hub.Queue(function () {
      var all = MathJax.Hub.getAllJax(),
        i;
      // console.log(all);
      for (i = 0; i < all.length; i += 1) {
        console.log(all[i].SourceElement().parentNode)
        all[i].SourceElement().parentNode.className += ' has-jax';
      }
    });
  }

  function reprocessMathJax() {
    if (typeof MathJax !== 'undefined') {
      MathJax.Hub.Queue(["Typeset", MathJax.Hub]);
    }
  }
</script>




<script src="//cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js"></script>
<script src="/js/plugin.js"></script>
<script src="/js/obsidian.js"></script>
<script src="/js/jquery.truncate.js"></script>
<script src="/js/search.js"></script>


<script src="//cdn.bootcss.com/typed.js/2.0.10/typed.min.js"></script>


<script src="//cdn.bootcss.com/blueimp-md5/2.12.0/js/md5.min.js"></script>


<script src="//cdnjs.cloudflare.com/ajax/libs/social-share.js/1.0.16/js/social-share.min.js"></script>


<script src="https://cdn.bootcss.com/codemirror/5.48.4/codemirror.min.js"></script>

    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/javascript/javascript.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/css/css.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/xml/xml.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/htmlmixed/htmlmixed.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/clike/clike.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/php/php.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/shell/shell.min.js"></script>


    
<script src="//cdn.bootcss.com/codemirror/5.48.4/mode/python/python.min.js"></script>




    
<script src="/js/busuanzi.min.js"></script>

    <script>
        $(document).ready(function () {
            if ($('span[id^="busuanzi_"]').length) {
                initialBusuanzi();
            }
        });
    </script>



<link rel="stylesheet" href="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe.min.css">
<link rel="stylesheet" href="//cdn.bootcss.com/photoswipe/4.1.3/default-skin/default-skin.min.css">


<script src="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe.min.js"></script>
<script src="//cdn.bootcss.com/photoswipe/4.1.3/photoswipe-ui-default.min.js"></script>


<!-- Root element of PhotoSwipe. Must have class pswp. -->
<div class="pswp" tabindex="-1" role="dialog" aria-hidden="true">
    <!-- Background of PhotoSwipe. 
         It's a separate element as animating opacity is faster than rgba(). -->
    <div class="pswp__bg"></div>
    <!-- Slides wrapper with overflow:hidden. -->
    <div class="pswp__scroll-wrap">
        <!-- Container that holds slides. 
            PhotoSwipe keeps only 3 of them in the DOM to save memory.
            Don't modify these 3 pswp__item elements, data is added later on. -->
        <div class="pswp__container">
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
            <div class="pswp__item"></div>
        </div>
        <!-- Default (PhotoSwipeUI_Default) interface on top of sliding area. Can be changed. -->
        <div class="pswp__ui pswp__ui--hidden">
            <div class="pswp__top-bar">
                <!--  Controls are self-explanatory. Order can be changed. -->
                <div class="pswp__counter"></div>
                <button class="pswp__button pswp__button--close" title="Close (Esc)"></button>
                <button class="pswp__button pswp__button--share" title="Share"></button>
                <button class="pswp__button pswp__button--fs" title="Toggle fullscreen"></button>
                <button class="pswp__button pswp__button--zoom" title="Zoom in/out"></button>
                <!-- Preloader demo http://codepen.io/dimsemenov/pen/yyBWoR -->
                <!-- element will get class pswp__preloader--active when preloader is running -->
                <div class="pswp__preloader">
                    <div class="pswp__preloader__icn">
                      <div class="pswp__preloader__cut">
                        <div class="pswp__preloader__donut"></div>
                      </div>
                    </div>
                </div>
            </div>
            <div class="pswp__share-modal pswp__share-modal--hidden pswp__single-tap">
                <div class="pswp__share-tooltip"></div> 
            </div>
            <button class="pswp__button pswp__button--arrow--left" title="Previous (arrow left)">
            </button>
            <button class="pswp__button pswp__button--arrow--right" title="Next (arrow right)">
            </button>
            <div class="pswp__caption">
                <div class="pswp__caption__center"></div>
            </div>
        </div>
    </div>
</div>







<script>
    function initialTyped () {
        var typedTextEl = $('.typed-text');
        if (typedTextEl && typedTextEl.length > 0) {
            var typed = new Typed('.typed-text', {
                strings: ["Life Long &amp; Pwn", "生命不息，破解不止"],
                typeSpeed: 90,
                loop: true,
                loopCount: Infinity,
                backSpeed: 20,
            });
        }
    }

    if ($('.article-header') && $('.article-header').length) {
        $(document).ready(function () {
            initialTyped();
        });
    }
</script>


    
<script src="//unpkg.com/valine/dist/Valine.min.js"></script>

    <script>

        var valine = new Valine();

        function initValine(path) {
            if (!path) path = window.location.pathname;
            let language = '';
            if (!language) {
                language = 'en';
            } else {
                language = language.toLowerCase();
            }
            valine.init({
                el: '#vcomments',
                appId: 'GnPlbHQ9xAWEoCDC8rR3zALj-gzGzoHsz',
                appKey: 'Nygd2awSxr9ioTDtvbH6hE0l',
                notify: 'false',
                verify: 'false',
                avatar: 'mm',
                placeholder: 'feel free to comment~',
                visitor: 'true',
                path: path,
                lang: language
            });
        }

        $(document).ready(function () {
            initValine();
        });
    </script>



</html>
<!-- 页面点击小红心 -->
<script type="text/javascript" src="/js/love.js"></script>
<!-- 烟火效果 -->
<canvas class="fireworks" style="position: fixed;left: 0;top: 0;z-index: 1; pointer-events: none;" ></canvas> 
<script type="text/javascript" src="//cdn.bootcss.com/animejs/2.2.0/anime.min.js"></script> 
<script type="text/javascript" src="/js/fireworks.js"></script>
<!--自定义标题-->
<script type="text/javascript" src="\js\title.js"></script>
